19 lines
1.1 KiB
Markdown
19 lines
1.1 KiB
Markdown
# Optional security audit checklist
|
|
|
|
Select checks for the requested surface. Record observed controls and evidence;
|
|
unchecked items do not automatically become blocking work outside the task.
|
|
|
|
- Runtime input validation and product-specific byte/field/batch limits.
|
|
- Verified identity and resource/tenant authorization on private reads and writes.
|
|
- Relevant session, CSRF, and rate-limit behavior.
|
|
- Upload allowlist, streaming cap, content validation, storage isolation, and safe serving.
|
|
- User-influenced URL parsing, all-address DNS checks, connection enforcement,
|
|
IPv4/IPv6 policy, redirect controls, time/byte limits, and egress restrictions.
|
|
- Credential redaction across logs and telemetry; public errors omit internal traces.
|
|
- Parameterized values and separately validated dynamic SQL identifiers.
|
|
- Browser content/framing policies appropriate to the application's actual flows.
|
|
- Meaningful negative cases for the changed controls, with remaining gaps stated.
|
|
|
|
Helper names and constants follow the existing project. No particular framework,
|
|
file cap, pagination limit, or security helper is required by this checklist.
|